CompTIA SecAI+ (CY0-001) Practice Questions with Explanations

Correct answer: D

Data access controls regulate which AI systems and users can access specific tables and datasets, directly addressing the security requirement to control AI system permissions. Network access control lists operate at the network layer for traffic filtering, agentic AI access relates to autonomous agent capabilities, and model access is less specific than data access controls which are needed to restrict table visibility.

Why the other options are wrong:

• A. Agentic AI access controls autonomous agent capabilities, not database table access.
• B. Network ACLs filter network traffic, not database or table-level access permissions.
• C. Model access is too broad; data access controls specifically govern table and dataset permissions.

Correct answer: C

The European Union AI Act is the most directly applicable legal framework for reviewing HR AI systems for compliance. This regulation specifically addresses AI systems used in employment and hiring decisions, establishing legal requirements for high-risk AI applications in human resources. It provides the binding legal standards that auditors must reference for legal compliance in this context.

Why the other options are wrong:

• A. OECD standards provide guidance and principles but are not binding legal requirements like the EU AI Act.
• B. NIST RMF is a risk management framework for the US and provides best practices but is not the legal standard for EU HR AI systems.
• D. ISO standards provide general quality and management frameworks but do not specifically address the legal requirements for AI systems in HR.

Correct answer: A

When an AI fraud detection system produces false positives (blocking legitimate transactions), the issue stems from model accuracy and the patterns it learned. Retraining with more data and recent transaction patterns addresses the root cause by improving the model's ability to distinguish between legitimate and fraudulent transactions, which is the best long-term solution.

Why the other options are wrong:

• B. Token usage and rate limits address resource management, not the accuracy problem causing false positives.
• C. Encryption and access controls protect data security but don't fix the underlying model accuracy issue.
• D. Rolling back to a traditional system abandons the AI solution rather than fixing the identified problem through improved training.

Correct answer: B

The NIST AI Risk Management Framework is the most appropriate reference for assessing posture management and organizational practices around machine learning use cases. It provides comprehensive guidance on managing AI risks across development, deployment, and operational phases.

Why the other options are wrong:

• A. OECD standards address economic and organizational cooperation topics but are not specific to AI risk management.
• C. The EU AI Act is a regulatory requirement focused on compliance classification, not a framework for summarizing ML risk posture.
• D. A GAN is a machine learning architecture, not a reference framework for assessing organizational ML posture or risk management.

Correct answer: D

Automated penetration testing uses AI to systematically identify vulnerabilities by testing different attack vectors and adapting based on outcomes. The description of using AI to suggest different attack vectors based on previous results, while trying to bypass organizational boundaries, directly matches the methodology of AI-driven penetration testing.

Why the other options are wrong:

• A. Manual signature matching is a passive detection technique that does not involve suggesting and executing attack vectors.
• B. Code quality testing focuses on code defects and standards compliance, not active attack vector exploration.
• C. Fraud detection identifies suspicious transactions or behaviors, not attack methodology for security testing.

Correct answer: B

The Adversarial Threat Landscape for AI Systems (ATLAS) is specifically designed as a threat model framework for AI systems. It provides a structured approach to identifying, categorizing, and understanding threats specific to AI/ML systems, making it the most appropriate choice for threat modeling an AI-based application.

Why the other options are wrong:

• A. Responsible AI focuses on ethical principles and governance rather than threat modeling and security vulnerabilities.
• C. OECD provides AI principles and governance guidelines but is not a formal threat modeling framework.
• D. ISO standards like ISO 27001 address information security generally but ATLAS is specifically tailored for AI threat modeling.

Correct answer: B

Convolutional neural networks excel at pattern recognition in unstructured data, particularly images, text, and complex signal data. CNNs use convolutional layers to automatically detect spatial patterns and features, making them ideal for extracting meaningful patterns from unstructured datasets.

Why the other options are wrong:

• A. Long short-term memory networks are specialized for sequential data with temporal dependencies, not general unstructured pattern recognition.
• C. Decision trees work best with structured, tabular data with clear feature boundaries, not unstructured data.
• D. Logistic regression is a linear classifier requiring structured numerical features and is not designed for unstructured data analysis.

Correct answer: D

A prompt filter examines incoming text for obfuscation techniques (hidden characters, emojis masking content, Unicode tricks) and can detect and block attempts to bypass context window limits with encoded payloads. This directly addresses the attack vector described. Fraud detection targets financial anomalies, LLM-as-a-judge evaluates output quality, and pattern recognition is too generic-only prompt filters specifically validate and sanitize input before it reaches the model's context window.

Why the other options are wrong:

• A. Fraud detection identifies financial anomalies, not obfuscation or context window exhaustion attacks.
• B. LLM-as-a-judge evaluates generated output correctness, not input validation or DoS prevention.
• C. Pattern recognition is too broad and doesn't specifically prevent obfuscated prompt injection at the input layer.

Correct answer: B

Data leakage is the most impactful security risk for generative AI chatbots because these systems often retain, memorize, or inadvertently reproduce training data or user inputs in their responses. Sensitive information, personal data, or proprietary information can be exposed through model outputs, affecting confidentiality at scale. This risk has broad impact across users and data. Overly permissive access, weak encryption, and model validation are concerns but are narrower in scope compared to widespread data exposure.

Why the other options are wrong:

• A. Overly permissive access is an access control issue that can be mitigated through proper IAM policies.
• C. Weak encryption is a specific technical control that can be addressed; it is narrower than data leakage risk.
• D. Model validation is important but addresses model accuracy rather than the broad data exposure risk chatbots pose.

Correct answer: D

Watermarking is a proactive technical mechanism that embeds identifying markers into AI- generated images during creation, enabling reliable detection later. This is a direct, verifiable method designed specifically for this purpose. Human validation is subjective and unreliable. Guardrails are preventative controls, not detection methods. Diffusion is a generative technique used to create images, not to prove their origin.

Why the other options are wrong:

• A. Human validation is subjective and unreliable for detecting sophisticated AI- generated images.
• B. Guardrails are safety constraints applied during generation, not detection mechanisms for identifying AI-created content.
• C. Diffusion is the generative technique used to create AI images, not a method to prove they were AI-generated.

Correct answer: B

Following a secure model development life cycle (MDLC) is the foundational best practice that encompasses all security activities for AI systems, including threat modeling, secure training, validation, and deployment phases specific to machine learning. A secure MDLC is purpose-built for AI security unlike a generic SDLC, and it encompasses guardrail testing and security architecture as components within a comprehensive framework.

Why the other options are wrong:

• A. Guardrail testing is important but represents only one component of comprehensive AI security.
• C. Security architecture is necessary but incomplete without the systematic MDLC framework.
• D. Generic SDLC lacks AI-specific security practices needed for ML model security.

Correct answer: A

Option A provides the most balanced approach by leveraging AI for automated triage and ticket creation while maintaining human oversight for the critical merge decision. This strategy maximizes efficiency gains from AI while preserving human judgment for high-risk code changes. Option B has AI handling merges, which is risky for code quality. Option C lacks AI automation entirely. Option D removes all human oversight from merging, which is inappropriate for critical production changes.

Why the other options are wrong:

• B. Allowing AI to merge software fixes without human review introduces unacceptable risk to code integrity and security.
• C. Failing to use AI for triage eliminates efficiency gains and doesn't address the goal of reducing mean time to fix.
• D. Removing human oversight from the merge process bypasses critical quality and security controls for production code.

Correct answer: A

Before customer trials of an AI-powered application, data masking and sanitization must be implemented to prevent exposure of sensitive customer information (payment details, personal identifiers, etc.) in both training data and system outputs. This protects customer privacy and prevents compliance violations. External audits occur after implementation, vendor lists are for procurement decisions, and third-party risk management applies to external dependencies-but none are prerequisites for safe trial release like data protection controls.

Why the other options are wrong:

• B. External compliance audits are post-implementation validation, not a prerequisite before customer trials begin.
• C. Approved vendor lists address supply chain management, not data protection during customer trials.
• D. Third-party risk management is relevant for external partnerships but doesn't directly protect customer data in the application itself.

Correct answer: B

Model accuracy metrics in logs directly reflect whether the AI system is delivering correct predictions and reliable outputs-critical to user experience. Poor accuracy directly degrades the user experience. Rate monitoring tracks API usage patterns, access controls verify authorization, and data storage addresses infrastructure-but model accuracy directly measures the quality and correctness of AI outputs that users experience.

Why the other options are wrong:

• A. Rate monitoring tracks usage volume and API call frequency, not the quality of AI outputs affecting user experience.
• C. Access controls ensure authorized users can reach the system, but don't measure whether outputs are correct or useful.
• D. Data storage addresses infrastructure capacity and organization, not the performance or accuracy of model predictions.

Correct answer: C

A risk assessment is the foundational first step before deploying any system handling sensitive data like healthcare records. It identifies potential threats, vulnerabilities, and impacts specific to the chatbot's use case, which informs all subsequent security decisions including access controls, data channels, and prompt firewalls.

Why the other options are wrong:

• A. Prompt firewalls are a tactical security control that should be implemented after understanding risks through assessment.
• B. Role-based access management is a necessary control but should be configured based on risks identified in the assessment.
• D. Secure communication channels are important but implementing them without first understanding risks may not address all vulnerabilities.

Correct answer: D

Configuration standards establish baseline security requirements, secure defaults, and hardening procedures that developers must implement to protect AI systems from attack, unauthorized access, and data breaches. Intake processes handle onboarding, acceptable use policies define user behavior rules, and development guidelines provide coding best practices-but only configuration standards directly mandate the technical hardening of infrastructure.

Why the other options are wrong:

• A. Intake processes manage initial requirements gathering, not infrastructure hardening.
• B. Acceptable use policies define user conduct, not infrastructure security controls.
• C. Development guidelines cover coding practices but configuration standards specifically mandate hardening deployment and infrastructure setup.

Correct answer: A

Implementing checksums is the best technical strategy to ensure data integrity. Checksums generate hash values from data that can be verified to detect any unauthorized or accidental modifications during storage, transmission, or processing. This is a direct, cryptographic approach to integrity assurance.

Why the other options are wrong:

• B. Human evaluation is subjective and does not provide automated, reproducible data integrity verification.
• C. Querying the model tests model functionality and outputs, not the integrity of the source dataset itself.
• D. Log monitoring tracks system events and access but does not verify the integrity of data content.

Correct answer: A

Agentic AI refers to autonomous AI agents that can break down complex tasks into smaller subtasks, plan sequences of actions, execute them independently, and adapt based on results. This is ideal for automating multiple security tasks by decomposing them into manageable steps and executing them with minimal human intervention. RAG AI is for information retrieval, generative AI is for content creation, and chatbots are for user interaction-none are designed for autonomous multi-step task automation.

Why the other options are wrong:

• B. RAG AI is designed for retrieving and augmenting information, not for breaking down and automating multiple security tasks.
• C. Generative AI creates content but is not specifically designed for autonomous task decomposition and multi-step automation.
• D. Chatbots are conversational interfaces and are not designed to autonomously break down and execute complex multi-step security tasks.

Correct answer: C

When corporate end users input data into public-facing LLMs, that data may be retained, used for model training, or accessed by third parties, creating exposure of confidential business information and personal data. This violates data protection regulations like GDPR, CCPA, and HIPAA. While hallucinations and malicious code are real concerns, they affect output quality rather than regulatory compliance. Outdated acceptable use policies are a governance issue but less immediately threatening than direct data exposure.

Why the other options are wrong:

• A. Hallucinations reduce output quality but don't create regulatory or compliance violations.
• B. Outdated policies are a governance problem, not the most acute risk compared to data exposure.
• D. Malicious code generation is a capability concern, not the primary risk from data submission to public services.

Correct answer: D

Summarizing alerts and extracting insights from environment data leverages AI for threat analysis and situational awareness while maintaining human oversight and decision- making. This enhances SOC efficiency without dangerous automation. Generating code and executing in production without human review creates operational risk; enabling fully autonomous agents removes critical human oversight; and open-source models in production introduce unvetted security and supply chain risks.

Why the other options are wrong:

• A. Automated code generation and production execution without human validation introduces severe operational and security risks.
• B. Autonomous agents with no human intervention violate security best practices requiring human oversight in critical operations.
• C. Unvetted open-source models lack security hardening, support, and compliance guarantees required for production threat detection.

Correct answer: B

Session hijacking is an on-path attack where an attacker intercepts and takes control of an active user session with the application. This allows the attacker to manipulate requests to the AI system, injecting malicious prompts or modifying the data flow, resulting in unrelated outputs and offensive content. The attack occurs between the user and application server rather than targeting the model, infrastructure, or domain directly.

Why the other options are wrong:

• A. Application server hijacking would compromise the entire server, not just session- level interactions.
• C. Domain hijacking affects DNS and domain ownership, not the session interaction with the AI application.
• D. Model hijacking refers to compromising the model itself, not intercepting user sessions on-path.

Correct answer: A

Guardrails are input validation and content filtering rules that prevent malicious instructions or sensitive data (like credit card numbers) from being processed by the model. They can detect and block attempts to inject prompts that manipulate model behavior or expose system vulnerabilities. Antivirus targets malware at the host level, WAF protects web applications from HTTP-layer attacks, and RBAC controls user access-but only guardrails specifically prevent prompt injection by filtering and validating LLM input.

Why the other options are wrong:

• B. Antivirus addresses malware on endpoints and networks, not prompt injection attacks targeting language models.
• C. WAF protects web application HTTP requests but cannot filter malicious prompts within LLM interaction layers.
• D. RBAC controls who can access systems, not what malicious instructions are submitted within prompts to the model.

Correct answer: C

Payload creation is best automated with AI during DAST because AI can generate diverse, context-aware attack payloads at scale, test them against applications, and iterate based on responses. This directly supports dynamic testing by automatically crafting and delivering varied malicious inputs without manual effort.

Why the other options are wrong:

• A. DDoS attacks involve coordinated network traffic and are not a primary focus of application-level DAST.
• B. Data poisoning involves corrupting training data and is not applicable to dynamic application software testing.
• D. Threat modeling is a planning and analysis activity, not an automated attack technique executed during DAST execution.

Correct answer: B

Data augmentation is the technique used to address imbalanced label distribution in machine learning models. It involves creating synthetic examples of underrepresented classes through transformations, replication, or generative methods to balance the training dataset and improve model performance across all classes.

Why the other options are wrong:

• A. Data lineage tracks the origin and flow of data but doesn't address class imbalance.
• C. Data provenance documents data source and history but doesn't resolve imbalance issues.
• D. Data verification checks data quality and correctness but doesn't balance class distributions.

Correct answer: B

Model inversion is a security attack where an adversary reconstructs sensitive training data (including personal medical records) from a trained model, making it the most relevant security concern for sensitive data exposure. Overfitting is a performance issue, data normalization is a preprocessing technique, and hyperparameter tuning is a modeling optimization task-none specifically address sensitive data exposure risks.

Why the other options are wrong:

• A. Overfitting is a model performance issue, not a mechanism for sensitive data exposure.
• C. Data normalization is a preprocessing technique unrelated to data security or exposure.
• D. Hyperparameter tuning is a model optimization process, not a security vulnerability.

Correct answer: D

Enabling stack call and debugging level traces at the function level provides the deepest visibility into internal activity and execution flow of an AI system. This approach captures detailed function-level execution information, variable states, and control flow, which is essential for understanding internal behavior during runtime operations.

Why the other options are wrong:

• A. SIEM tools are designed for security event management across infrastructure but may not provide sufficient granularity into AI model internal operations.
• B. WAF with header logging focuses on web layer attacks and request/response headers, not internal AI system activity.
• C. Relying solely on vendor controls and prompt input monitoring does not provide visibility into the internal computational processes and function-level execution of the AI system.

Correct answer: C

One-shot prompting involves providing a single example of the desired behavior to guide the AI model's output. The HR officer is including an example resume of a successful candidate to demonstrate what kind of results they want, which is the defining characteristic of one-shot prompting. This technique helps the model understand the pattern by showing one concrete example.

Why the other options are wrong:

• A. Distillation is a model compression technique where a larger model's knowledge is transferred to a smaller model, not a prompting strategy.
• B. A prompt template is a reusable structure with placeholders, not specifically about providing example outputs to demonstrate desired behavior.
• D. System role defines the AI's persona or function but doesn't involve providing examples of successful outputs.

Correct answer: C

Rate limiting is the primary control that prevents denial-of-service attacks by restricting the number of requests an API endpoint can receive within a time period. A brute force DoS attack succeeds by overwhelming the API with excessive requests, and rate limiting directly blocks this attack vector by rejecting requests that exceed configured thresholds.

Why the other options are wrong:

• A. Tokenization protects data confidentiality through encoding, not API availability against DoS attacks.
• B. Model guardrails constrain model behavior and outputs, not API request volume or availability.
• D. A prompt firewall filters malicious prompts but does not address excessive request volume that characterizes brute force DoS attacks.

Correct answer: C

MLOps (Machine Learning Operations) encompasses practices and tools for monitoring, logging, versioning, and auditing AI systems throughout their lifecycle. It provides comprehensive observability through model tracking, performance monitoring, data validation, and audit trails that enable systematic oversight and accountability. Redeploying doesn't improve observability, manual detection doesn't scale, and anomaly detection is a component within MLOps rather than a comprehensive solution.

Why the other options are wrong:

• A. Redeploying a model alone does not improve observability or auditing capabilities without supporting infrastructure.
• B. Manual detection is not scalable or systematic for comprehensive observability of AI systems.
• D. Anomaly detection is a technique used within observability frameworks but is not comprehensive enough to address all auditing requirements.

Correct answer: D

MITRE ATLAS (Adversarial Threat Landscape for AI Systems) is specifically designed for threat modeling of AI systems and provides a comprehensive knowledge base of tactics, techniques, and procedures used by adversaries against AI/ML systems. It is the most appropriate framework for an architect performing threat modeling to systematically identify which attacks can be performed against the AI system. While OWASP Top 10 is useful for application security, ATLAS is the specialized framework for AI threat modeling.

Why the other options are wrong:

• A. Using an LLM to map attack paths is not a systematic threat modeling approach and lacks the rigor of established frameworks.
• B. Quantifying risk of known vulnerabilities comes after identifying potential threats and attack paths.
• C. While trust boundaries and OWASP Top 10 are useful, they are application-focused, not specifically designed for AI system threats like ATLAS.

Correct answer: C

Data poisoning is the deliberate corruption or manipulation of training or reference data to degrade AI model performance or cause incorrect outputs. The employee directly modified the company policies that the chatbot references, poisoning the data source the model relies on, causing the chatbot to provide incorrect information based on corrupted input data.

Why the other options are wrong:

• A. Data reduction involves decreasing dataset size or dimensionality for processing, not intentional corruption.
• B. Data masking obscures sensitive data for privacy, not corruption of data sources.
• D. Data leaking refers to unintended exposure of data, not deliberate modification of data to disrupt operations.

Correct answer: A

The NIST AI Risk Management Framework (RMF) is specifically designed to address risks associated with AI systems throughout their lifecycle, including model training. It provides structured guidance on identifying, measuring, and managing AI-specific security and safety risks during development and deployment.

Why the other options are wrong:

• B. ISO 27001 addresses general information security management but is not specifically tailored for AI model training risks.
• C. OECD provides principles for AI governance and responsible development but is not a dedicated framework for managing training-specific security issues.
• D. GDPR focuses on data privacy and personal data protection rights rather than the security of model training processes themselves.

Correct answer: A

The payload shows a suspicious SECURITY_UPDATE tag containing a shell script URL that is not part of legitimate hardening procedures. This is a prompt injection/command injection attack attempting to manipulate the agentic system into executing arbitrary commands. The most effective control is to add logic that validates inputs against an approved whitelist of legitimate security commands and tags before execution. This prevents the system from running unauthorized commands even if they appear in seemingly authoritative messages, directly addressing the root cause of the attack vector.

Why the other options are wrong:

• B. Deprecating and retraining the model is a long-term solution that doesn't address the immediate vulnerability in the current system and doesn't prevent similar attacks from other vectors.
• C. Ignoring the SECURITY_UPDATE tag entirely removes a legitimate mechanism for actual security updates and doesn't solve the underlying input validation problem.
• D. Using only approved libraries is a general best practice but doesn't specifically prevent malicious command injection through deceptive payloads like this SECURITY_UPDATE tag.

Correct answer: B

Fine-tuning is the process of taking a pre-trained model and adapting it with additional training on new, unstructured data (text, images, audio, etc.). This approach is specifically designed to leverage unstructured data by building on existing model knowledge. Statistical learning requires structured numerical data, supervised learning requires labeled data, and reinforcement training focuses on reward-based learning rather than learning from unstructured data directly.

Why the other options are wrong:

• A. Statistical learning typically requires structured, numerical data rather than unstructured data.
• C. Supervised learning requires labeled training data with explicit input-output pairs, not raw unstructured data.
• D. Reinforcement training uses reward signals and agent interactions, not unstructured raw data as its primary training mechanism.